Eliminate duplicate content and improve documentation

Removed duplicated content in Markdown and HTML formats, retaining only the Markdown version. Improved clarity and consistency in the documentation.

Signed-off-by: LUIZ HAMILTON ROBERTO DA SILVA <[email protected]>

Author: brazilianscriptguy

BlueTeam-Tools/EventLogMonitoring/PrintService-Operacional-EventLogs.md

@@ -1,97 +1,79 @@
-## What’s repeated (and why)
-
-Yes — you have **the same content twice**, just in two formats:
-
-- **Markdown section** (starts with `# Configuring Windows Event Log...`)
-- **HTML section** (starts with `<div><h1>🖨️ Configuring Windows Event Log...`)
-
-They repeat the same fields:
-
-- Title / Synopsis / Description / Author / Version / Notes  
-- Deployment instructions (steps 1–6)
-- Best practices and final notes
-- Closing paragraph
-
-So the “repeatable information” is not small redundancy inside the Markdown; it’s a **full duplication** because both Markdown and HTML versions were included.
-
----
-
-## Recommended revision: keep ONE format (Markdown) and remove the HTML block
-
-Below is a cleaned, non-duplicated Markdown-only version (same meaning, tighter wording, and no repeated blocks):
-
-```markdown
 # Configuring Windows Event Log for PrintService Operational Log
 
 ## Synopsis
 Configures Windows Event Log settings for the **Microsoft-Windows-PrintService/Operational** channel.
 
 ## Description
-This `.reg` configuration automates key Event Log parameters such as `AutoBackupLogFiles`, `Flags`, log file path (`File`), maximum size (`MaxSize` / `MaxSizeUpper`), and retention (`Retention`) to support reliable PrintService logging.
+This `.reg` configuration automates key Event Log parameters to support reliable PrintService logging, including:
+
+- `AutoBackupLogFiles`
+- `Flags`
+- Log file path (`File`)
+- Maximum size (`MaxSize` / `MaxSizeUpper`)
+- Retention policy (`Retention`)
 
 ## Author
-Luiz Hamilton Silva — @brazilianscriptguy
+Luiz Hamilton Silva — `@brazilianscriptguy`
 
 ## Version
-Last Updated: November 26, 2024
+**Last Updated:** 2024-11-26
 
 ## Notes
-- Ensure the target log path (value `File`) exists and is reachable by the system.
-- Apply the `.reg` with administrative privileges (or deploy via GPO) to ensure registry changes succeed.
+- Ensure the target log path (registry value `File`) exists and is reachable by the **Local System** context.
+- Apply the `.reg` file with **administrative privileges** (or deploy via **GPO**) to ensure registry changes succeed.
+
+---
 
 ## Deployment Instructions
 
 ### 1) Save the `.reg` file
 Save the provided registry content as:
-`PrintService-Operacional-EventLogs.reg`
+
+- **Filename:** `PrintService-Operacional-EventLogs.reg`
 
 ### 2) Store it in a shared location
-Place the file on a shared path accessible to target machines (read access for the accounts applying the change).
+Place the file on a shared path accessible to target machines (ensure **read access** for the accounts/computers applying the change).
 
 ### 3) Deploy via Group Policy Object (GPO)
-1. Open **GPMC** (`gpmc.msc`)
-2. Create/edit a GPO linked to the target OU
-3. Go to: `Computer Configuration` → `Preferences` → `Windows Settings` → `Registry`
-4. Create Registry Items with:
-   - **Action:** Update  
-   - **Hive:** `HKEY_LOCAL_MACHINE`  
-   - **Key Path:** `SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`  
+1. Open **Group Policy Management Console (GPMC)**:
+   - Press `Win + R`, type `gpmc.msc`, press `Enter`.
+2. Create or edit a GPO linked to the target OU.
+3. Navigate to:
+   - `Computer Configuration` → `Preferences` → `Windows Settings` → `Registry`
+4. Create Registry Items with the following settings:
+   - **Action:** `Update`
+   - **Hive:** `HKEY_LOCAL_MACHINE`
+   - **Key Path:** `SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`
    - **Values:**
-     - `AutoBackupLogFiles` (DWORD) = `1`
-     - `Flags` (DWORD) = `1`
-     - `File` (REG_SZ) = `L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx`
-     - `MaxSize` (DWORD) = `09270000`
-     - `MaxSizeUpper` (DWORD) = `00000000`
-     - `Retention` (DWORD) = `ffffffff`
+     - `AutoBackupLogFiles` (`DWORD`) = `1`
+     - `Flags` (`DWORD`) = `1`
+     - `File` (`REG_SZ`) = `L:\Microsoft-Windows-PrintService-Operational\Microsoft-Windows-PrintService-Operational.evtx`
+     - `MaxSize` (`DWORD`) = `09270000`
+     - `MaxSizeUpper` (`DWORD`) = `00000000`
+     - `Retention` (`DWORD`) = `ffffffff`
 
 ### 4) Force policy update
+Run:
+
 ```powershell
 gpupdate /force
 ```
-(or reboot)
 
-### 5) Verify registry
-Check:
+Or reboot the machine to apply the GPO at startup.
+
+### 5) Verify registry changes
+Confirm the values exist at:
+
 `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Microsoft-Windows-PrintService/Operational`
 
 ### 6) Monitor logs
-Confirm the `.evtx` is being created/updated at:
-`L:\Microsoft-Windows-PrintService-Operational\`
+Confirm the `.evtx` log file is being created/updated at:
 
-## Best Practices
-- Backup registry / test on a single machine first.
-- Validate that `L:` is consistently available on all endpoints (mapping/permissions).
-- Secure the log storage location against tampering.
-```
+`L:\Microsoft-Windows-PrintService-Operational\`
 
 ---
 
-## One important consistency note (optional but recommended)
-Your key path alternates between:
-
-- `Microsoft-Windows-PrintService/Operational` (with `/`)
-- `Microsoft-Windows-PrintService\Operational` (with `\`)
-
-In Windows Registry paths, it’s typically shown with backslashes. If you want maximum clarity, standardize the documentation to **one** form (I’d use `Microsoft-Windows-PrintService/Operational` only when referring to the *Event Log channel name*, and `...\Microsoft-Windows-PrintService\Operational` when referring to the *registry key path*).
-
-If you tell me which one your `.reg` actually uses, I’ll align the text precisely to match it.
+## Best Practices
+- Backup the registry and test on a single machine before wide deployment.
+- Validate that `L:` is consistently available on all endpoints (mapping, permissions, connectivity).
+- Secure the log storage location to prevent tampering (ACLs, monitoring, write restrictions).